Definition ∞ Dependency poisoning is a software supply chain attack where malicious code is introduced into a project through a compromised or deceptive external library. Attackers upload malicious versions of popular libraries to public repositories or create similarly named, harmful packages that developers inadvertently include in their projects. When the legitimate project builds, it pulls in the poisoned dependency, thereby integrating the hostile code. This method allows attackers to compromise systems that use the affected software without directly breaching the target’s infrastructure.
Context ∞ Dependency poisoning poses a significant and evolving threat to software security, particularly in open-source ecosystems widely used in blockchain development. Security advisories frequently warn about new instances of this attack, underscoring the need for vigilant dependency management and verification. The digital asset sector is particularly vulnerable due to its reliance on publicly available code, prompting stricter auditing and supply chain security practices.
Blockchain Knowledge
Cryptocurrency Foundation
Cryptospace Newsfeed
